Every EHR vendor claims their software is compliant, secure, and up to standard. But “compliant” isn’t a regulated term — anyone can put it on a homepage. ONC certification is different. It’s a specific, government-run testing process, and it’s one of the few claims a vendor makes that you can actually go verify yourself in a few minutes.
If you’ve read our guide on EMR vs EHR, you already know that certification matters more than the label a vendor uses. This guide goes one level deeper: what ONC certification actually tests for, why it exists, and how to check it before you sign a contract.
What Is ONC Certification?
ONC stands for the Office of the National Coordinator for Health Information Technology, a federal agency within the U.S. Department of Health and Human Services. The ONC Health IT Certification Program tests EHR products against a defined set of technical, security, and interoperability standards.
A product doesn’t certify itself, and it doesn’t certify once and stay certified forever. Vendors submit their software to accredited testing bodies, which verify the product meets the current criteria. Certification is tied to specific product versions, so an older version of a system might be certified while a newer or older release is not.
What Does Certification Actually Test For?
Certification isn’t a single yes/no checkbox. It covers several categories of functionality, including:
- Interoperability — whether the system can securely exchange patient data with other certified systems
- Security — including multi-factor authentication, data encryption both in transit and at rest, role-based access permissions that limit who can view specific records, and audit logs that track who accessed a patient’s data and when
- Clinical quality measures — the system’s ability to track and report quality metrics required by CMS programs
- Patient access — whether patients can view, download, and transmit their own health information
- API standards — support for FHIR-based APIs, which allow third-party apps to securely connect to the record
A product can be certified for some of these categories and not others, which is why checking the specific certification criteria matters more than just seeing a “certified” badge on a vendor’s website.
How ONC Certification Is Evolving?
Certification requirements aren’t fixed. ONC updates them as health IT and interoperability standards change, and buyers evaluating a system today should know that a certification earned a few years ago may not reflect current requirements.
The most significant recent update is the HTI-1 Final Rule, which expanded certification criteria around standardized FHIR APIs, updated data-sharing requirements under USCDI (the United States Core Data for Interoperability), and introduced new transparency requirements for predictive decision-support tools built into EHR software, so buyers can see how an algorithm reached a recommendation rather than treating it as a black box.
This area continues to move quickly. As of 2026, ONC has also proposed a further rule, HTI-5, that would scale back some of these requirements to reduce the compliance burden on vendors. In practice, this means certification criteria you read about today may shift again within a year or two. The safest approach isn’t to memorize the current rule set, but to ask any vendor directly which certification edition and criteria their product currently holds, and confirm it on CHPL rather than relying on older articles (including this one) as a permanent reference.
Why Certification Matters for Your Practice?
- It’s tied to federal reimbursement programs
Practices using certified EHR technology can qualify for the CMS Promoting Interoperability Program, which offers reimbursement incentives for demonstrating meaningful use of health IT. Using uncertified software can mean leaving that money on the table.
2. It protects you from vendor lock-in
Certified systems are required to support data export and exchange standards. This means if you ever switch vendors, a certified system makes it far easier to get your patient data out cleanly, instead of being stuck with a proprietary format only your original vendor can read.
3. It’s a genuine trust signal in a crowded market
With dozens of vendors in the EHR product directory all claiming to be the best fit for your practice, certification status is one of the only claims that’s independently verifiable rather than marketing language.
- It affects your ability to participate in referral networks
Hospitals and specialist networks increasingly expect incoming referrals to arrive through interoperable, certified systems. An uncertified EHR can quietly limit which networks and referral partners will work with your practice.
Certified vs. Non-Certified EHR: At a Glance
| Certified HER | Non-Certified EHR | |
| Independent verification | Meets ONC testing standards | No independent verification |
| CMS program eligibility | Can qualify for reimbursement incentives | May not qualify |
| Interoperability | Standards-based data exchange | Often limited or proprietary |
| Switching vendors | Easier data export, less lock-in | Higher risk of vendor lock-in |
| Vendor claims | Publicly verifiable on CHPL | Difficult to independently confirm |
How to Check If an EHR Is Actually Certified?
Don’t take a vendor’s word for it. You can independently verify certification status in under five minutes:
- Go to the Certified Health IT Product List (CHPL), the ONC’s public, searchable database.
- Search for the vendor or product name.
- Review which specific criteria the product is certified for, and which version of the software the certification applies to.
- Confirm the certification hasn’t expired or been withdrawn — CHPL lists current status, not just historical certification.
This is a good step to take alongside comparing pricing and features when you’re reviewing options like the ones covered in our guide to the best EMR vendors in 2026.
ONC Certification Checklist Before Buying
✔ Ask the vendor for their certification ID
✔ Search the product directly on the CHPL database
✔ Verify the certification applies to the software version you’ll actually receive
✔ Check which specific certification criteria are covered, not just a general “certified” claim
✔ Confirm current FHIR API support
✔ Ask how patient data export works if you ever switch vendors
✔ Verify eligibility for CMS Promoting Interoperability incentives
Real World Testing: What Most Buyers Don’t Know
Certification isn’t only tested in a lab. ONC-certified developers are also required to participate in Real World Testing, which means demonstrating that certified capabilities, like FHIR-based data exchange, actually function correctly in live clinical settings, not just in a controlled testing environment during initial certification.
This matters because a system can pass lab-based certification testing and still behave differently once it’s handling real patient data across real provider networks. Real World Testing results are intended to catch that gap. It’s worth noting that this requirement is one of the areas under review in the proposed HTI-5 rule mentioned earlier, so buyers should confirm with a vendor whether ongoing real-world testing still applies to their specific product at the time of purchase.
Common Misconceptions About ONC Certification
“Certified” doesn’t mean “best.” Certification confirms a baseline of interoperability and security standards. It doesn’t mean a product is the best fit for your specialty, workflow, or budget — that still requires its own comparison.
Certification isn’t permanent. A product certified two years ago on an older version may not carry that certification forward automatically. Always check the version currently being sold to you, not just the vendor’s general claim.
Small or budget-friendly vendors can still be certified. Certification isn’t reserved for large enterprise systems. Many smaller, specialty-focused EHR vendors maintain full certification — cost and certification status are independent of each other.
Frequently Asked Questions
1. Is ONC certification legally required?
It’s not required to operate an EHR system, but it is required if your practice wants to participate in CMS incentive programs or demonstrate meaningful use under federal health IT initiatives.
2. How do I know if my current EHR is certified?
Search your software’s name directly on the Certified Health IT Product List. If you can’t find it, contact your vendor and ask them to provide their certification ID.
3. Does certification cost the practice anything?
No. Certification is a cost borne by the vendor during development and testing. It shouldn’t add to what your practice pays for the software, though certified systems can sometimes carry a higher base price due to the added development required.
4. Can a certified EHR lose its certification?
Yes. Products can be decertified if they no longer meet requirements or if a vendor fails to maintain compliance. This is another reason to check current status on CHPL rather than relying on outdated marketing claims.
5. Is certification the same across all EHR vendors?
No. Certification applies to specific product versions and specific criteria. Two “certified” products can support very different levels of interoperability, so it’s worth checking which criteria each one actually meets.
Making ONC Certification Part of Your EHR Decision
ONC certification is one of the few genuinely objective ways to evaluate an EHR vendor’s claims. It won’t tell you whether a system fits your specialty or your budget, but it will tell you whether the product meets baseline federal standards for security and interoperability, and whether your practice can use it to qualify for reimbursement incentives. Before signing with any vendor, take five minutes to verify their certification status directly rather than relying on their website copy.
Editorial disclosure: This article was compiled from publicly available federal sources (ONC, CHPL, CMS.gov) and is for general information only, not legal or compliance advice. Certification requirements change over time, so confirm current status directly with ONC/CMS before making a purchasing decision.
